Last I checked my cox configuration, I noticed:

* no filtering of ports 22, 25, 80  (well, by cox anyway :-)
* cox is sending 'logservers' in the reply:
* renewal at expiration onto the same IP (it looks staticky to me)

 | > pump -s
 | Device eth0
 |         IP: 68.2.xx.xx
 |         Netmask: 255.255.240.0
 |         Broadcast: 68.2.xx.255
 |         Network: 68.2.xx.0
 |         Boot server 172.19.yy.yy
 |         Next server 172.19.yy.yy
 |         Gateway: 68.2.xxx.1
 |         Boot file: xxxxxx.cfg
 |         Domain: ph.cox.net
 |         Nameservers: 68.2.16.30 68.4.16.30
 |         Logservers: 172.19.yy.yy
 |         Renewal time: Mon Jan 28 14:11:32 2002
 |         Expiration time: Mon Jan 28 15:41:32 2002

I don't believe *pump* is setting logservers up appropriately (based
on genning some syslog events with firewall dropping outbound packets
to that host) but others with more 'compliant' dhcp clients might want
to take a look at the configs.

Also note the 'logservers' are mimicking the 'Boot Server' and 'Next
Server' entries....which to me means that that's the DHCP server of
choice...which might also be listening hopefully for your logs.

YMMV.

David